REST complete
user and sessions